Re: [PATCH] drm/qxl: remove double page-size scaling in kmap fallback paths

[sashiko-bot@kernel.org]

> qxl_bo_kmap_atomic_page() takes a page_offset parameter that callers
> compute as a byte offset aligned to a page boundary:
> 
>     reloc_page = qxl_bo_kmap_atomic_page(qdev, info->dst_bo,
>                                          info->dst_offset & PAGE_MASK);
> 
> The VRAM/PRIV path adds it directly to the mapping base (both in
> bytes), which is correct:
> 
>     offset = bo->tbo.resource->start << PAGE_SHIFT;
>     return io_mapping_map_atomic_wc(map, offset + page_offset);
> 
> But the two system-memory fallback paths multiply it by PAGE_SIZE
> again:
> 
>     rptr = bo->kptr + (page_offset * PAGE_SIZE);
> 
> For page_offset = 0x5000 (page 5), this computes
> 0x5000 * 0x1000 = 0x5000000, a 80 MiB offset instead of 20 KiB,
> producing a massive out-of-bounds access into kernel memory.
> 
> Remove the spurious multiplication so the fallback paths use the
> same byte-offset semantics as the io_mapping path.
> 
> Fixes: f64122c1f6ad ("drm: add new QXL driver. (v1.4)")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Signed-off-by: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923134952.1750600-1-qwe.aldo@gmail.com?part=1